Method and device for controlling access request on basis of proxy gateway

Abstract

The present invention relates to the field of communications, and provides a method and apparatus for controlling an access request based on a proxy gateway, for improving the security of a proxy gateway application system. wherein the method comprises: an proxy gateway receives a Hypertext Transfer Protocol Secure (HTTPS) access request for establishing a Transport Layer Security (TLS) connection transmitted by a terminal; based on a preset sifting policy, the proxy gateway judges whether 2-tuple control parameters carried in the HTTPS access request are legal, if yes, the terminal is allowed to establish the TLS connection through the HTTPS access request, or else the terminal is rejected to establish the TLS connection through the HTTPS access request. Thus, the HTTPS access request for establishing the TLS connection can be flexibly managed and controlled by using the preset 2-tuple control parameters, the illegal TLS connection is effectively blocked off, more flexible protection measures are provided for the proxy gateway application system, and the security and flexibility of service control flow of the proxy gateway are improved.

Description

technical field [0001] The invention relates to the communication field, in particular to a method and device for controlling based on Https access requests. Background technique [0002] With the development of Internet technology, users' demand for larger-scale and richer-form services on the Internet is also growing. At present, WAP (Wireless Application Protocol, wireless application protocol) gateway is usually used as the Internet proxy of terminal users. The most basic function of WAP gateway is to act as a proxy server for terminals, proxying terminals to access WAP websites and Internet content, and providing basic http proxy services And the protocol conversion function of WAP1.x. In order to protect the user's private data, the WAP gateway provides an encrypted data access channel requested by https, called the TLS (Transport Layer Security Protocol, Transport Layer Security Protocol) tunnel, and the user negotiates the key through the two ends of the TLS tunnel....

AI Technical Summary

Problems solved by technology

[0003] However, the https (referring to the http service encrypted with TLS) proxy service has its own defects, that is, the HTTP CONNECT proxy server is a proxy server that allows users to establish a TCP connection to any port, which means that this proxy can not only be used for http Proxy service can also be used for FTP, IRC, RM streaming services, etc., and can even be used for scanning and attacking. For example, the terminal can take advantage of the defect that the WAP gateway cannot process Https request data, and use the HTTP CONNECT proxy to monitor important systems of the WAP gateway. Scanning, attacking, etc.

Images